1 /*
2 * Unix SMB/CIFS implementation.
3 * Authentication utility functions
4 * Copyright (C) Andrew Tridgell 1992-1998
5 * Copyright (C) Andrew Bartlett 2001
6 * Copyright (C) Jeremy Allison 2000-2001
7 * Copyright (C) Rafal Szczesniak 2002
8 * Copyright (C) Volker Lendecke 2006
9 * Copyright (C) Michael Adam 2007
10 *
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
15 *
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
20 *
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "../libcli/security/security.h"
27 #include "passdb.h"
28 #include "lib/winbind_util.h"
29 #include "../librpc/gen_ndr/idmap.h"
30
31 /**
32 * Add sid as a member of builtin_sid.
33 *
34 * @param[in] builtin_sid An existing builtin group.
35 * @param[in] dom_sid sid to add as a member of builtin_sid.
36 * @return Normal NTSTATUS return
37 */
add_sid_to_builtin(const struct dom_sid * builtin_sid,const struct dom_sid * dom_sid)38 static NTSTATUS add_sid_to_builtin(const struct dom_sid *builtin_sid,
39 const struct dom_sid *dom_sid)
40 {
41 NTSTATUS status;
42
43 if (!dom_sid || !builtin_sid) {
44 return NT_STATUS_INVALID_PARAMETER;
45 }
46
47 status = pdb_add_aliasmem(builtin_sid, dom_sid);
48
49 if (NT_STATUS_EQUAL(status, NT_STATUS_MEMBER_IN_ALIAS)) {
50 struct dom_sid_buf buf1, buf2;
51 DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
52 dom_sid_str_buf(dom_sid, &buf1),
53 dom_sid_str_buf(builtin_sid, &buf2)));
54 return NT_STATUS_OK;
55 }
56
57 if (!NT_STATUS_IS_OK(status)) {
58 struct dom_sid_buf buf1, buf2;
59 DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
60 "%s\n",
61 dom_sid_str_buf(dom_sid, &buf1),
62 dom_sid_str_buf(builtin_sid, &buf2),
63 nt_errstr(status)));
64 }
65 return status;
66 }
67
68 /**
69 * Create the requested BUILTIN if it doesn't already exist. This requires
70 * winbindd to be running.
71 *
72 * @param[in] rid BUILTIN rid to create
73 * @return Normal NTSTATUS return.
74 */
pdb_create_builtin(uint32_t rid)75 NTSTATUS pdb_create_builtin(uint32_t rid)
76 {
77 NTSTATUS status = NT_STATUS_OK;
78 struct dom_sid sid;
79 gid_t gid;
80 bool mapresult;
81
82 if (!sid_compose(&sid, &global_sid_Builtin, rid)) {
83 return NT_STATUS_NO_SUCH_ALIAS;
84 }
85
86 if (!pdb_is_responsible_for_builtin()) {
87 /*
88 * if this backend is not responsible for BUILTIN
89 *
90 * Use the gid from the mapping request for entry.
91 * If the mapping fails, bail out
92 */
93 mapresult = sid_to_gid(&sid, &gid);
94 if (!mapresult) {
95 status = NT_STATUS_NO_SUCH_GROUP;
96 } else {
97 status = pdb_create_builtin_alias(rid, gid);
98 }
99 } else {
100 /*
101 * this backend is responsible for BUILTIN
102 *
103 * a failed mapping result means that the entry
104 * does not exist yet, so create it
105 *
106 * we use pdb_sid_to_id intentionally here to
107 * directly query the passdb backend (sid_to_gid
108 * would finally do the same)
109 */
110 struct unixid id;
111 mapresult = pdb_sid_to_id(&sid, &id);
112 if (!mapresult) {
113 if (!lp_winbind_nested_groups() || !winbind_ping()) {
114 return NT_STATUS_PROTOCOL_UNREACHABLE;
115 }
116 status = pdb_create_builtin_alias(rid, 0);
117 }
118 }
119 return status;
120 }
121
122 /*******************************************************************
123 *******************************************************************/
124
create_builtin_users(const struct dom_sid * dom_sid)125 NTSTATUS create_builtin_users(const struct dom_sid *dom_sid)
126 {
127 NTSTATUS status;
128 struct dom_sid dom_users;
129
130 status = pdb_create_builtin(BUILTIN_RID_USERS);
131 if ( !NT_STATUS_IS_OK(status) ) {
132 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
133 return status;
134 }
135
136 /* add domain users */
137 if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) &&
138 (dom_sid != NULL) &&
139 sid_compose(&dom_users, dom_sid, DOMAIN_RID_USERS))
140 {
141 status = add_sid_to_builtin(&global_sid_Builtin_Users,
142 &dom_users);
143 }
144
145 return status;
146 }
147
148 /*******************************************************************
149 *******************************************************************/
150
create_builtin_administrators(const struct dom_sid * dom_sid)151 NTSTATUS create_builtin_administrators(const struct dom_sid *dom_sid)
152 {
153 NTSTATUS status;
154 struct dom_sid dom_admins, root_sid;
155 fstring root_name;
156 enum lsa_SidType type;
157 TALLOC_CTX *ctx;
158 bool ret;
159
160 status = pdb_create_builtin(BUILTIN_RID_ADMINISTRATORS);
161 if ( !NT_STATUS_IS_OK(status) ) {
162 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
163 return status;
164 }
165
166 /* add domain admins */
167 if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER)) &&
168 (dom_sid != NULL) &&
169 sid_compose(&dom_admins, dom_sid, DOMAIN_RID_ADMINS))
170 {
171 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
172 &dom_admins);
173 if (!NT_STATUS_IS_OK(status)) {
174 return status;
175 }
176 }
177
178 /* add root */
179 if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
180 return NT_STATUS_NO_MEMORY;
181 }
182 fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
183 ret = lookup_name(ctx, root_name, LOOKUP_NAME_DOMAIN, NULL, NULL,
184 &root_sid, &type);
185 TALLOC_FREE( ctx );
186
187 if ( ret ) {
188 status = add_sid_to_builtin(&global_sid_Builtin_Administrators,
189 &root_sid);
190 }
191
192 return status;
193 }
194
195 /*******************************************************************
196 *******************************************************************/
197
create_builtin_guests(const struct dom_sid * dom_sid)198 NTSTATUS create_builtin_guests(const struct dom_sid *dom_sid)
199 {
200 NTSTATUS status;
201 struct dom_sid tmp_sid = { 0, };
202
203 status = pdb_create_builtin(BUILTIN_RID_GUESTS);
204 if (!NT_STATUS_IS_OK(status)) {
205 DEBUG(5,("create_builtin_guests: Failed to create Guests\n"));
206 return status;
207 }
208
209 /* add local guest */
210 if (sid_compose(&tmp_sid, get_global_sam_sid(), DOMAIN_RID_GUEST)) {
211 status = add_sid_to_builtin(&global_sid_Builtin_Guests,
212 &tmp_sid);
213 if (!NT_STATUS_IS_OK(status)) {
214 return status;
215 }
216 }
217
218 /* add local guests */
219 if (sid_compose(&tmp_sid, get_global_sam_sid(), DOMAIN_RID_GUESTS)) {
220 status = add_sid_to_builtin(&global_sid_Builtin_Guests,
221 &tmp_sid);
222 if (!NT_STATUS_IS_OK(status)) {
223 return status;
224 }
225 }
226
227 if (lp_server_role() != ROLE_DOMAIN_MEMBER) {
228 return NT_STATUS_OK;
229 }
230
231 if (dom_sid == NULL) {
232 return NT_STATUS_INTERNAL_ERROR;
233 }
234
235 /* add domain guests */
236 if (sid_compose(&tmp_sid, dom_sid, DOMAIN_RID_GUESTS)) {
237 status = add_sid_to_builtin(&global_sid_Builtin_Guests,
238 &tmp_sid);
239 if (!NT_STATUS_IS_OK(status)) {
240 return status;
241 }
242 }
243
244 return NT_STATUS_OK;
245 }
246